new pattern

scan.py

@@ -530,7 +530,7 @@ def is_hacked(filename):
             or 'https://www.colourbox.com/preview/11775720-hacker-boy-icon.jpg' in l \
             or 'https://image.prntscr.com/image/dQ_-z9pTRL6tA2kqbnXH6A.jp' in l:
             score.append(('SOCIALS', ''))
-        if "<?php $[a-z].* = '" and "$[a-z].*=explode(chr(([0-9].*[-+][0-9].*))" and "$[a-z].*=([0-9].*[-+][0-9].*)" and "if (!function_exists('[a-z].*'))" in l:
+        if re.compile("<?php\s*\$[a-z]{1,10}\s*=.*\$[a-z]{1,10}=explode\(chr\(\([0-9]{1,10}.*[0-9]{1,10}\)\).*\$[a-z]{1,10}=\([0-9].*[0-9]{1,10}\).*if\s*\(!function_exists\('[a-z]{1,10}'\)\)").match(l):
             score.append(('EITEST', ''))
         previous_line = l